Threat actors are exploiting CVE-2026-26980, a critical Ghost CMS vulnerability, to compromise websites and turn trusted pages into delivery points for ClickFix attacks.
The campaign, reported by QiAnXin XLab, abuses an SQL injection flaw in Ghost’s Content API. The issue has a CVSS score of 9.4 and was fixed in Ghost version 6.19.1 in February 2026. The vulnerability was discovered by Anthropic using Claude.
The practical risk is straightforward: attackers can use the flaw to read sensitive database content from vulnerable Ghost instances. XLab said the attackers used that access to obtain Ghost Admin API keys and then tamper with published articles in bulk. The claim that an Admin API key can directly modify articles through the Ghost Admin API has not been independently verified here, but it is consistent with the reported attack pattern.
How the Ghost CMS Attack Works
The campaign appears to be a large-scale poisoning operation rather than a simple one-off defacement. XLab said the activity was first detected on May 7, 2026, and has affected more than 700 websites.
The affected sites reportedly span universities, blockchain projects, artificial intelligence companies, SaaS businesses, security research sites, media outlets, fintech companies, and personal publishing sites. That mix matters because visitors are more likely to trust prompts shown on a legitimate site they already recognize.
Attackers injected JavaScript at the bottom of Ghost articles. That script acted as a two-stage loader, pulling the main payload from attacker-controlled infrastructure at runtime. This setup gives the operators flexibility: they can keep the same small loader planted across many compromised sites while changing what the visitor receives later.
The external script functions like a traffic distribution system. It collects browser and environment signals, sends that fingerprinting data back to the server, and then decides whether to redirect, show pop-ups, trigger downloads, or take other actions. Researchers attributed the cloaking layer to Adspect, a commercial traffic filtering service often discussed in the context of malvertising and evasion.
That filtering is important for defenders. A crawler, sandbox, or security scanner may see a harmless page, while a real user matching the attacker’s targeting rules may receive the malicious flow. XLab also reported that the script supports 19 commands for running JavaScript and controlling browser-side behavior, although that specific capability has not been independently verified here.
Malwarebytes Premium Security
Endpoint protection can help catch malicious downloads, suspicious scripts, ransomware behavior, and fraudulent web destinations after a user is exposed to a compromised page. Malwarebytes Premium Security is a practical option for small teams protecting a few Windows, Mac, Android, or iOS devices.
As an Amazon Associate I earn from qualifying purchases.
Why ClickFix Makes This Campaign More Dangerous
ClickFix attacks rely less on browser exploitation and more on social engineering. Instead of silently exploiting the visitor’s machine, the page tells the user to perform a set of actions under the pretext of verification, troubleshooting, or proving they are human.
In this Ghost CMS campaign, selected visitors were shown a fake CAPTCHA verification page inside an iframe. The page instructed them to copy and paste a Base64-encoded command into the Windows Run dialog. That is the critical moment: the victim is tricked into launching the attack chain manually.
Once executed, the command worked as a dropper. It downloaded a ZIP archive, extracted a Windows batch script, and ran it. The batch script then executed PowerShell to retrieve a follow-on payload, launch it with Windows system tooling, and open a decoy page to distract the user.
Researchers observed later versions replacing the DLL stage with a JavaScript payload. In both paths, the campaign’s goal was to place a Windows executable on the victim’s machine. XLab reported that one DLL-linked chain dropped a PuTTY client with a valid code-signing certificate; that specific detail has not been independently verified here. Another chain reportedly delivered an Inno Setup installer for an Electron application.
The Electron application was described as a modified version of the open-source Grape desktop client. According to the report, it was designed for persistence and periodically checked in with attacker infrastructure to receive instructions such as running JavaScript or executable files.
What Ghost Site Owners Should Do Now
Any organization running Ghost should treat this as an urgent CMS integrity issue, not just a patching task. If a site was vulnerable after the February 2026 fix became available, administrators should assume that content and secrets may need review.
Recommended response steps include:
- Upgrade Ghost to the latest available version, with version 6.19.1 as the minimum fixed release for CVE-2026-26980.
- Rotate Ghost Admin API keys, staff credentials, integration tokens, database credentials, and any secrets exposed to the Ghost instance.
- Review published and draft articles for injected script tags, especially near the bottom of article content.
- Check Ghost, reverse proxy, CDN, and web server logs for unusual Content API activity, bulk content edits, or access patterns beginning around May 7, 2026.
- Inspect recent admin actions and integration activity for changes that do not match normal publishing workflows.
- Notify visitors if logs or telemetry suggest they may have been exposed to the fake CAPTCHA flow.
For buyers evaluating CMS security tools, the lesson is that patch management alone is not enough. Teams also need monitoring that can detect unexpected content changes, suspicious script injection, and abnormal API activity on production publishing systems.
ESET Home Security Essential
For site owners and editors, endpoint security is useful on the machines used to access Ghost admin, handle credentials, and investigate suspicious downloads. ESET Home Security Essential adds antivirus, anti-ransomware, browsing protection, and device security features for a single workstation.
As an Amazon Associate I earn from qualifying purchases.
What to Watch For in Security Monitoring
The most useful detections are the ones tied to the actual attack path. Defenders should look beyond generic malware alerts and focus on how a trusted CMS page becomes a delivery mechanism.
| Area to Review | What to Look For |
|---|---|
| Ghost version | Any instance older than 6.19.1 should be treated as exposed until proven otherwise. |
| Article content | Unexpected JavaScript, iframe code, or loader snippets appended to posts. |
| API activity | Bulk article edits, unfamiliar integrations, or abnormal Content API and Admin API calls. |
| User reports | Complaints about fake CAPTCHA prompts, Windows Run instructions, pop-ups, or unexpected downloads. |
| Endpoint telemetry | PowerShell, batch scripts, rundll32 activity, ZIP extraction, or unfamiliar Electron installers after a site visit. |
Ghost operators should also preserve evidence before cleaning infected content. Export affected articles, retain relevant access logs, and document the timeline of compromise. That record will help determine whether the attack only altered public content or whether credentials, user data, or integrations were also exposed.
The bigger takeaway is that CMS compromise can quickly become visitor compromise. A patched Ghost instance, rotated credentials, clean content, and verified logs are the baseline. Without all four, a site owner may remove the visible script while leaving behind the access path that allowed it to appear in the first place.